The EU Digital Rulebook in 2026: What Applies to You, and From When

The legal framework

The EU regulates the digital economy through dozens of separate texts. This article lists the main ones, grouped by theme, with their status on 13 November 2026. Three kinds of text appear:

• a regulation applies directly in every Member State from the dates it sets;
• a directive must be transposed into national law, so in Belgium you also need the Belgian law or decree;
• a proposal is not law. It can still change, or never be adopted.

Each act links to its page on EUR-Lex. Proposals also link to the European Parliament's Legislative Observatory, which shows where the procedure stands.

Artificial intelligence

Text	Status	Dates
AI Act, Regulation (EU) 2024/1689	In force since 1 August 2024, applies in stages	Prohibitions and AI literacy from 2 February 2025; general-purpose AI models from 2 August 2025; most other rules from 2 August 2026; high-risk from 2 December 2027 (Annex III) and 2 August 2028 (Annex I)
Digital Omnibus on AI, Regulation (EU) 2026/1744	In force since 27 July 2026	New prohibitions from 2 December 2026; output marking for older generative systems by 2 December 2026; national sandboxes by 2 August 2027
Product Liability Directive (EU) 2024/2853	In force since 8 December 2024	Transposition by 9 December 2026; applies to products placed on the market after that date
Digital Omnibus, COM(2025) 837, 2025/0360(COD)	Proposal of 19 November 2025, awaiting committee decision	Would amend the GDPR, the cookie rule and the Data Act

Cybersecurity

Text	Status	Dates
Cyber Resilience Act, Regulation (EU) 2024/2847	In force since 10 December 2024	Chapter IV from 11 June 2026; reporting under Article 14 from 11 September 2026; everything else from 11 December 2027
NIS2 Directive (EU) 2022/2555	In force since 16 January 2023	In Belgium, the NIS2 Law of 26 April 2024 (Belgian Official Gazette 17 May 2024), in force since 18 October 2024
Cybersecurity Act, Regulation (EU) 2019/881 and its revision COM(2026) 11, 2026/0011(COD)	Act in force; revision proposed, awaiting committee decision
NIS2 amendments, COM(2026) 13 of 20 January 2026, 2026/0012(COD)	Proposal, awaiting committee decision
Cyber Solidarity Act, Regulation (EU) 2025/38	In force since 4 February 2025

Data

Text	Status	Dates
Data Act, Regulation (EU) 2023/2854	Applies since 12 September 2025	Design duty of Article 3(1) for products placed on the market after 12 September 2026
Data Governance Act, Regulation (EU) 2022/868	Applies since 24 September 2023
Open Data Directive (EU) 2019/1024 and Implementing Regulation (EU) 2023/138 on high-value datasets	In force	High-value datasets since 9 June 2024
European Health Data Space, Regulation (EU) 2025/327	In force since 25 March 2025	Applies in stages on 26 March 2027, 2029, 2031 and 2035
Copyright Directive (EU) 2019/790, Articles 3 and 4	In force	Text and data mining exceptions, relevant for AI training
GDPR, Regulation (EU) 2016/679 and ePrivacy Directive 2002/58/EC	Apply	GDPR since 25 May 2018

Platforms, consumers and media

Text	Status	Dates
Digital Services Act, Regulation (EU) 2022/2065	Applies since 17 February 2024
Digital Markets Act, Regulation (EU) 2022/1925	Applies since 2 May 2023
EU KIDS Act, COM(2026) 681 of 17 September 2026, 2026/0286(COD)	Proposal, awaiting committee decision
Commission Recommendation (EU) 2026/1035 on age verification	Adopted 29 April 2026, not binding
Digital Fairness Act	Presented on 11 November 2026	Existing consumer law: Directive 2005/29/EC, Directive 2011/83/EU and Directive (EU) 2019/2161
European Accessibility Act, Directive (EU) 2019/882	Applies since 28 June 2025	In Belgium through several federal and regional laws and decrees
Web Accessibility Directive (EU) 2016/2102	Applies	Public sector websites and apps
European Media Freedom Act, Regulation (EU) 2024/1083	Applies since 8 August 2025
Audiovisual Media Services Directive 2010/13/EU	Applies, as amended

Identity, public sector and procurement

Text	Status	Dates
eIDAS, Regulation (EU) No 910/2014, amended by Regulation (EU) 2024/1183	Amendment in force since 20 May 2024	Wallets within 24 months of the entry into force of the implementing acts (Article 5a)
Anti-Money Laundering Regulation (EU) 2024/1624	In force since 9 July 2024	Applies from 10 July 2027
European Business Wallets, COM(2025) 838, 2025/0358(COD)	Proposal; Parliament confirmed its negotiating mandate on 7 October 2026
Interoperable Europe Act, Regulation (EU) 2024/903	Applies since 12 July 2024	Some provisions from 12 January 2025
Single Digital Gateway, Regulation (EU) 2018/1724	Applies
Cloud and AI Development Act, COM(2026) 502 of 3 June 2026, 2026/0138(COD)	Proposal, awaiting committee decision	Interacts with Directive 2014/24/EU on public procurement

Computing, chips and funding

Text	Status	Dates
EuroHPC, Council Regulation (EU) 2021/1173, amended by Council Regulation (EU) 2026/150	Amendment in force since 20 January 2026
Chips Act, Regulation (EU) 2023/1781 and Chips Act 2.0, COM(2026) 504, 2026/0139(COD)	Act applies; the proposal of 3 June 2026 would repeal it
Quantum Act	Expected on 18 November 2026
Digital Europe, Regulation (EU) 2021/694, Horizon Europe, Regulation (EU) 2021/695, InvestEU, Regulation (EU) 2021/523	Apply	Funding programmes

What moved in 2026

The year brought one adopted change to an existing act and a wave of proposals.

• Adopted. The Digital Omnibus on AI moved the high-risk dates of the AI Act to 2 December 2027 and 2 August 2028 and added two prohibitions. Council Regulation (EU) 2026/150 amended the EuroHPC rules from 20 January 2026. The Commission adopted its age verification Recommendation on 29 April 2026.
• Started to apply. Chapter IV of the Cyber Resilience Act on 11 June 2026, its reporting duty on 11 September 2026, the Data Act's design duty for new connected products on 12 September 2026, and the bulk of the AI Act, including Article 50 transparency, on 2 August 2026.
• Proposed. The Cybersecurity Act revision (COM(2026) 11), the NIS2 amendments of 20 January 2026, the Cloud and AI Development Act and Chips Act 2.0 on 3 June 2026, the EU KIDS Act on 17 September 2026 and the Digital Fairness Act on 11 November 2026.

In practice

Most of these texts target a specific role. Start from what your company does, not from the list.

A software company selling a SaaS tool in Belgium will usually meet the GDPR, the Data Act's cloud switching rules, the AI Act if the tool uses AI, the Product Liability Directive for products placed on the market after 9 December 2026, and the Cyber Resilience Act if it sells software that is a product with digital elements. If it supplies government, the Interoperable Europe Act and procurement law come in too. See SaaS agreements.

A manufacturer of connected machines meets the Data Act's design duty for products placed on the market after 12 September 2026, the Cyber Resilience Act's reporting duty since 11 September 2026, the AI Act if a safety function runs on AI, and product liability.

An online shop meets the GDPR and cookie rules, consumer law, the European Accessibility Act since 28 June 2025 for its e-commerce service (Article 2(2)(f); microenterprises providing services are exempt under Article 4(5)) and, as a marketplace, the Digital Services Act.

A brand owner can use the Digital Services Act's notice and action and trusted flagger rules against counterfeits. See online brand protection.

A company in a NIS2 sector in Belgium must follow the Belgian NIS2 Law since 18 October 2024. See the NIS2 Directive.

Practical steps

1. List your roles. Provider, deployer, manufacturer, data holder, platform, service provider to government. Each role triggers different texts.
2. Map the dates. Put every applicable date in one calendar. Our AI Act register does this for AI, and our contract register tracks the duties in your contracts.
3. Separate law from proposals. Do not change your compliance for a proposal, but budget for it.
4. Check your contracts. Many of these rules require written terms: AI supply chains (AI Act Article 25(4)), data sharing (Data Act Chapter IV), cloud switching (Data Act Chapter VI).
5. Keep records. Most texts ask you to show what you did. Your records of processing are a starting point.

Frequently asked questions

Which of these apply to every company?

The GDPR, if you process personal data, which nearly every company does. Most others depend on your sector, size or role.

Do proposals have any legal effect?

No. A proposal only becomes law when Parliament and Council adopt it and it is published in the Official Journal.

How do I know a date is still correct?

Open the consolidated version on EUR-Lex. Dates in a regulation only change through another legislative act, as the Digital Omnibus on AI showed.

Where are the Belgian rules?

Directives such as NIS2, the European Accessibility Act and the Product Liability Directive need Belgian transposition. Regulations such as the AI Act, the Data Act and the DSA apply directly, with national rules on authorities and penalties.

How this connects

This is the opening article of our series on the EU digital rulebook. The deep dives, by theme:

• AI: the Digital Omnibus on AI, the AI Act timeline, general-purpose AI: codes, guidelines and standards, AI regulatory sandboxes and real-world testing, AI, software and the new Product Liability Directive and the wider Digital Omnibus: GDPR, cookies and the Data Act
• Cybersecurity: the Cyber Resilience Act in three parts, on products and classes, vulnerability handling and reporting and importers, distributors and open source; the NIS2 Directive, the 2026 cybersecurity package and the Cyber Solidarity Act
• Data: the EU Data Act, design duties for connected products, the Data Governance Act, data for AI, re-using public-sector data, non-personal data across borders and the European Health Data Space on secondary use and data permits and health-record systems and wellness apps
• Platforms, consumers and media: the DSA as a brand-protection tool, platform and marketplace duties under the DSA, the DMA for business users, children online and age verification, the Digital Fairness Act, the European Accessibility Act on scope and exemptions and websites, apps and e-commerce, and the European Media Freedom Act
• Identity, government and cloud: the EU Digital Identity Wallet, European Business Wallets, Interoperable Europe, the Cloud and AI Development Act and switching cloud providers
• Computing, chips and funding: AI Factories and EuroHPC, Chips Act 2.0 and the Quantum Act, the EU Open Source Strategy and funding for AI and digital projects

Related guides: the EU Data Act, cookies and consent, sanctions screening and anti-money laundering, RFI and RFP procurement, IP grants and tax incentives in Belgium and the practical overview of the AI Act.

Our AI Act compliance, external data protection officer and commercial contracts teams help you sort out which rules apply.

Key dates. 2 December 2026: new AI prohibitions. 9 December 2026: Product Liability Directive. 26 March 2027: first EHDS stage. 10 July 2027: AMLR. 2 August 2027: national AI sandboxes. 2 December 2027: high-risk AI under Annex III. 11 December 2027: Cyber Resilience Act in full. 2 August 2028: high-risk AI under Annex I.